Version: 1:7.0.7
OS: Debian 12.7
I have create a bridge using the ip package in /etc/network/interfaces that links two interfaces together named enp1s0f0 and enp1s0f1 into br0.
I have setup Suricata using af-packet using the following config:
af-packet:
- interface: br0
threads: 8
cluster-id: 98
cluster-type: cluster_qm
defrag: no
use-mmap: yes
buffer-size: 262144
I have the following test rule setup (no other rules that conflict)
drop ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7; metadata:created_at 2010_09_23, updated_at 2019_07_26;)
And I get the following alerts in my eve.json (but it doesn’t block):
alert: {
action: "allowed",
category: "Potentially Bad Traffic",
gid: 1,
metadata: {
created_at: [
"2010_09_23"
],
updated_at: [
"2019_07_26"
]
},
rev: 7,
rule: "drop ip any any -> any any (msg:\"GPL ATTACK_RESPONSE id check returned root\"; content:\"uid=0|28|root|29|\"; classtype:bad-unknown; sid:2100498; rev:7; metadata:created_at 2010_09_23, updated_at 2019_07_26;)",
severity: 2,
signature: "GPL ATTACK_RESPONSE id check returned root",
signature_id: 2100498
},
It allowed the traffic to go through. I was under the understanding in AF-Packet mode without a copy it would still be able to block traffic.
I switch to:
af-packet:
- interface: enp1s0f1
threads: 8
cluster-id: 98
cluster-type: cluster_qm
defrag: no
use-mmap: yes
buffer-size: 262144
copy-mode: ips
copy-iface: enp1s0f0
- interface: enp1s0f0
threads: 8
cluster-id: 98
cluster-type: cluster_qm
defrag: no
use-mmap: yes
buffer-size: 262144
copy-mode: ips
copy-iface: enp1s0f1
and it blocks fine but the throughput goes from 6 Gbps (above) to 2 Gbps max.
alert: {
action: "blocked",
category: "Potentially Bad Traffic",
gid: 1,
metadata: {
created_at: [
"2010_09_23"
],
updated_at: [
"2019_07_26"
]
},
rev: 7,
rule: "drop ip any any -> any any (msg:\"GPL ATTACK_RESPONSE id check returned root\"; content:\"uid=0|28|root|29|\"; classtype:bad-unknown; sid:2100498; rev:7; metadata:created_at 2010_09_23, updated_at 2019_07_26;)",
severity: 2,
signature: "GPL ATTACK_RESPONSE id check returned root",
signature_id: 2100498
},
Hoping theres just a small configuration issue with af-packet that allows it to run in IPS mode against a bridged interface.
Thanks,
Jake